Malwarebytes Bug Bounty Program Goes Live


So Malwarebytes bug bounty program is live, the official name is actually Malwarebytes Coordinated Vulnerability Disclosure Program – what a mouthful (guidelines here).

Malwarebytes Bug Bounty Program Goes Live

It’s good to see, bug bounty programs typically tend to have a nett positive effect and end in win-win situations for researchers and software vendors alike.

In an effort to encourage researchers to responsibly disclose security flaws found in its products, anti-malware company Malwarebytes announced on Monday the launch of a bug bounty program.

The company is prepared to offer between $100 and $1,000 for eligible vulnerabilities, depending on how severe and exploitable they are. Bounty hunters are also offered an entry in the Malwarebytes Hall of Fame and “cool Malwarebytes swag.”

Malwarebytes’ Coordinated Vulnerability Disclosure program covers vulnerabilities found in the company’s products and web services, particularly weaknesses that can lead to remote code execution or sensitive information disclosure. Experts are also encouraged to report crashes and stability issues, but these are generally considered not eligible for a bounty.

In the case of vulnerabilities discovered by Malwarebytes in third-party products, the company’s standard public disclosure deadline is 150 days.


No surprise here, Tavis Ormandy is up to his tricks again and quite possible is the driving force behind the release of this bounty program. As he recently found several pretty serious buggs in Malwarebytes software.

The disclosure period is nice and long too, they give themselves 5 months to fix any bugs found – that seems more than ample.

The launch of Malwarebytes’ bug bounty program comes after Google researcher Tavis Ormandy reported finding several vulnerabilities in the consumer version of Malwarebytes Anti-Malware in early November.

Marcin Kleczynski, the CEO of Malwarebytes, said his company patched several of the vulnerabilities server-side within days and is currently working on releasing a new version that will patch the client-side issues.

“The research seems to indicate that an attacker could use some of the processes described to insert their own code onto a targeted machine. Based on the findings, we believe that this could only be done by targeting one machine at a time,” Kleczynski said. “However, this is of sufficient enough a concern that we are seeking to implement a fix.”

Malwarebytes Anti-Malware Premium users can protect themselves against possible attacks leveraging the flaws reported by Ormandy by enabling the product’s self-protection feature.

It’s pretty good software, I’ve used it quite a few times to disinfect people’s machines. So if you do use it regularly, have a poke around and see if you can find any flaws – might be worthwhile now.

Good old Tavis Ormandy – he’s been poking holes in people’s software for years.

Source: Security Week

Posted in: Exploits/Vulnerabilities

, , , ,


Latest Posts:


Aclpwn.Py - Exploit ACL Based Privilege Escalation Paths in Active Directory Aclpwn.Py – Exploit ACL Based Privilege Escalation Paths in Active Directory
Aclpwn.py is a tool that interacts with BloodHound< to identify and exploit ACL based privilege escalation paths.
Vulhub - Pre-Built Vulnerable Docker Environments For Learning To Hack Vulhub – Pre-Built Vulnerable Docker Environments For Learning To Hack
Vulhub is an open-source collection of pre-built vulnerable docker environments for learning to hack. No pre-existing knowledge of docker is required, just execute two simple commands.
LibInjection - Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) LibInjection – Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS)
LibInjection is a C library to Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) through lexical analysis of real-world Attacks.
Grype - Vulnerability Scanner For Container Images & Filesystems Grype – Vulnerability Scanner For Container Images & Filesystems
Grype is a vulnerability scanner for container images and filesystems with an easy to install binary that supports the packages for most major *nix based OS.
APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc


Comments are closed.